Techniques › T1612 › AN1261
AN1261 Analytic 1261
Containers · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of container image build activity directly on the host using Docker or Kubernetes APIs. Defenders may observe Docker build requests, anomalous Dockerfile instructions (such as downloading code from unknown IPs), or creation of new images followed by immediate deployment. This behavior chain typically consists of an unexpected image creation event correlated with outbound network communication to non-standard or untrusted destinations.</p>
- Detects
- T1612 Build Image on Host
- Part of
- DET0459 Detection Strategy for Build Image on Host
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| docker:daemon | docker build or POST /build API request | DC0015 Image Creation |
| NSM:Flow | outbound connections from host during or immediately after image build | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
RegistryAllowList | Defines trusted registries for image pulls/builds. Builds referencing unapproved registries may indicate adversary behavior. |
NewImageThreshold | Threshold for number of new custom images created in a given time window. Exceeding this threshold may indicate malicious builds. |
TimeWindow | Defines correlation window (e.g., 5m) between suspicious build activity and subsequent network traffic anomalies. |